Installer step 4b: vault first, then set, then a PVE login (R-1145); host key off curl's argv (review F4); harness green and a gate (R-1146); hub 0.158.0 deploy evidence; independent review + verdicts

Live on demo-hp (--rotate-recovery-only): vault time moved, new value 200, old 401. Harness 52/0;
the R1145 cases fail against HEAD. Publishes only with the next installer tag.

scripts/test_gate_decoys.py

@@ -103,6 +103,8 @@ COVERS = {
                         "controller clone must be INCONCLUSIVE, never a pass"),
     "hostinstall":     ("R-426: R-185's regression with only its dry-run echo left, the age install commented "
                         "out, and a version const in a new hub sub-package; a comment naming the identifier passes"),
+    "hostinstall-harness": ("R-1146: the vault-after-set order of step 4b put back (R-1145's hole) must convict "
+                            "with R1145-b; a chpasswd outside step_break_glass convicts INV-2"),
     "due-checks":      ("R-426: a dated check whose id survives only in prose (orphan), the due-TODAY boundary "
                         "(and due-tomorrow, which must pass), and the block's marker named in prose (exit 2)"),
     "one-register":    ("R-426: an open roadmap row whose state NAMES another row's CLOSED (a live hole until "
@@ -718,6 +720,18 @@ decoy("hostinstall/comment-names-identifier", "hostinstall_gates.py",
                  u'package zzr426decoy\n\n// hostInstallVersion was deleted on purpose (R-94).\n'),
       expect="accept")
 
+# ── hostinstall-harness (R-1146, 2026-10-18) ────────────────────────────────────────────────────────
+# The label without the fact: step 4b keeps every message and every call, but sets the password BEFORE it vaults it
+# (the shape until installer 1.33.0, R-1145) — the harness must name R1145-b. And a chpasswd outside the step's body.
+decoy("hostinstall-harness/set-before-vault", "hostinstall_harness_gate.py",
+      replace_in(_HI, "    # 1. Vault to the hub over the host-key-authenticated channel; password only on stdin (-d @-). The host key rides\n",
+                 "    printf 'root:%s\\n' \"$newpw\" | chpasswd 2>/dev/null || die \"chpasswd failed\"\n"
+                 "    # 1. Vault to the hub over the host-key-authenticated channel; password only on stdin (-d @-). The host key rides\n"),
+      must="R1145-b")
+decoy("hostinstall-harness/chpasswd-outside-the-step", "hostinstall_harness_gate.py",
+      replace_in(_HI, "step_break_glass() {\n", "_decoy_r1146() { printf 'root:x\\n' | chpasswd; }\nstep_break_glass() {\n"),
+      must="INV-2")
+
 # ── due-checks (R-426, 2026-10-06) ──────────────────────────────────────────────────────────────
 #
 # The 2026-09-01 sweep's attempt was a no-op and was withdrawn. These are the shapes a session really